Tornado CashTornado Cash

CircuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level.-specific trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required. There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. for Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. Tornado Cash circuits. It was publicly announced as a Phase 2For Groth16 trusted setup, phase 2 represents circuit-dependent part of the trusted setup. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 2 trusted setup ceremony is known, arbitrary proofs could be forged. ceremony built on top of the 30th contribution to the Perpetual Powers of Tau ceremony, and completed in May 2020. It collected 1114 contributions over 10 days, with 450 publicly attributed and 664 anonymous contributions. Tornado Cash published the participant list, archive of contributions and artifacts, and the generated verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. contract.

Phase 1For Groth16 trusted setup, phase 1 represents circuit-independent part of the trusted setup (e.g. Perpetual Powers of Tau), which could be reused across different circuits. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 1 trusted setup ceremony is known, arbitrary proofs could be forged. includes 29 publicly attributed contributions and one anonymous contribution (ID 0015). These are contribution counts: Koh Wei Jie contributed at both IDs 0001 and 0014. Public attribution means a published name or handle, not verified real-world identity.

The Groth16 setup security assumption is that at least one honest contributor in each phase erased their secret randomness. Recovering the relevant toxic waste from either phase can enable forged proofs.

• Phase 1 ceremony (first 30 contributions are used): https://github.com/privacy-ethereum/perpetualpowersoftau.
• Phase 1 attribution list: https://github.com/privacy-ethereum/perpetualpowersoftau/blob/b077232729db7c9eb65b63c4aaaa0ac4a1b0bba2/README.md#ceremony-progress.
• Ceremony completion announcement: https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa
• Ceremony page with participant list and archive download: https://ceremony.tornado.cash/
• Initial ceremony announcement: https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1
• Ceremony code repository: https://github.com/tornadocash/phase2-bn254
• Groth16 ceremony security model: Snarky Ceremonies.